filenamemodule.1516.f7a0a50.72650000.dll
size312832 (0x4c600)
md533bc2071290db96962055a31795532d8
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
10577
1473072937
149307296
146307291
1323072967
1313072932
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7b81b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x2a000
SizeOfInitializedData0x22a00
SizeOfUninitializedData0
AddressOfEntryPoint0x19f22
BaseOfCode0x1000
BaseOfData0x2b000
ImageBase0x72650000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x4f000
SizeOfHeaders0x400
CheckSum0x5960f
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x29e080x2a000R-X CODE
.data0x2b0000x12bc0xc00RW- IDATA
.rsrc0x2d0000x1d8180x1da00R-- IDATA
.reloc0x4b0000x3b060x3c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x2ada00x68
IMPORT0x295440x12c
RESOURCE0x2d0000x1d818
EXCEPTION00
SECURITY00
BASERELOC0x4b0000x2784
DEBUG0x14e00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xa3a80x40
Bound_IAT0x2780x13c
IAT0x10000x4b0
Delay_IAT0x275a00x60
CLR_Header00
typenamesizecp
MUI#12960
UIFILE#201148690
UIFILE#202137540
UIFILE#20391180
WEVT_TEMPLATE#173460
XMLFILE#1005570
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#796400
ICON#842640
ICON#911280
ICON#1016400
ICON#117440
ICON#124880
ICON#132960
ICON#1437520
ICON#1522160
ICON#1617360
ICON#1713840
ICON#1896400
ICON#1942640
ICON#2024400
ICON#2111280
ICON#224880
ICON#232960
ICON#2417360
ICON#2513840
ICON#2624400
ICON#2711280
ICON#284880
ICON#292960
ICON#3017360
ICON#3113840
ICON#3224400
ICON#3311280
RCDATA#4710020
RCDATA#4710120
GROUP_ICON#2900
GROUP_ICON#3900
GROUP_ICON#470001320
GROUP_ICON#470011740
VERSION#19080
MANIFEST#211680
module_namehintordfunction_name
msvcrt.dll1246malloc
msvcrt.dll974_vsnwprintf
msvcrt.dll1361wcschr
msvcrt.dll1190free
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll1258memcpy
msvcrt.dll404_ftol2
msvcrt.dll1380wcsstr
msvcrt.dll1259memcpy_s
msvcrt.dll1373wcsncpy_s
msvcrt.dll1262memset
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll345_except_handler4_common
msvcrt.dll1279realloc
msvcrt.dll342_errno
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll747_onexit
ADVAPI32.dll441LsaLookupSids
ADVAPI32.dll427LsaFreeMemory
ADVAPI32.dll118CopySid
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll437LsaLookupNames2
ADVAPI32.dll445LsaOpenPolicy
ADVAPI32.dll108ConvertSidToStringSidW
ADVAPI32.dll344GetSidSubAuthorityCount
ADVAPI32.dll343GetSidSubAuthority
ADVAPI32.dll292GetAclInformation
ADVAPI32.dll291GetAce
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll263EqualSid
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll272EventWrite
ADVAPI32.dll347GetTraceEnableFlags
ADVAPI32.dll348GetTraceEnableLevel
ADVAPI32.dll349GetTraceLoggerHandle
ADVAPI32.dll650RegisterTraceGuidsW
ADVAPI32.dll770UnregisterTraceGuids
ADVAPI32.dll270EventRegister
ADVAPI32.dll271EventUnregister
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll758TraceMessage
ADVAPI32.dll114ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll713StartServiceW
ADVAPI32.dll552QueryServiceStatus
ADVAPI32.dll507OpenServiceW
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll92ControlService
ADVAPI32.dll605RegNotifyChangeKeyValue
ADVAPI32.dll488NotifyServiceStatusChangeW
ADVAPI32.dll116ConvertStringSidToSidW
ADVAPI32.dll397LogonUserW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll390IsValidSid
ADVAPI32.dll322GetNamedSecurityInfoW
ADVAPI32.dll413LsaClose
KERNEL32.dll642GetTempFileNameW
KERNEL32.dll644GetTempPathW
KERNEL32.dll82CloseHandle
KERNEL32.dll1317WriteFile
KERNEL32.dll143CreateFileW
KERNEL32.dll662GetTimeFormatW
KERNEL32.dll456GetDateFormatW
KERNEL32.dll513GetLocalTime
KERNEL32.dll1112SetEvent
KERNEL32.dll1243UnregisterWaitEx
KERNEL32.dll1202Sleep
KERNEL32.dll1012RegisterWaitForSingleObject
KERNEL32.dll133CreateEventW
KERNEL32.dll399GetComputerNameW
KERNEL32.dll658GetTickCount
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll674GetVersionExA
KERNEL32.dll748InterlockedExchange
KERNEL32.dll866MoveFileW
KERNEL32.dll1260VirtualFree
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll344FlushInstructionCache
KERNEL32.dll869MulDiv
KERNEL32.dll100CompareStringW
KERNEL32.dll512GetLastError
KERNEL32.dll715HeapAlloc
KERNEL32.dll584GetProcessHeap
KERNEL32.dll840LocalFree
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll828LoadLibraryA
KERNEL32.dll531GetModuleHandleA
KERNEL32.dll831LoadLibraryW
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll579GetProcAddress
KERNEL32.dll488GetFileAttributesW
KERNEL32.dll673GetVersion
KERNEL32.dll1137SetLastError
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll904OutputDebugStringA
KERNEL32.dll719HeapFree
KERNEL32.dll354FreeLibrary
KERNEL32.dll451GetCurrentThread
KERNEL32.dll195DeactivateActCtx
KERNEL32.dll2ActivateActCtx
KERNEL32.dll1013ReleaseActCtx
KERNEL32.dll120CreateActCtxW
KERNEL32.dll835LocalAlloc
KERNEL32.dll332FindResourceExW
KERNEL32.dll850LockResource
KERNEL32.dll993RegQueryValueExW
KERNEL32.dll349FormatMessageW
KERNEL32.dll978RegGetValueW
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll944RaiseException
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll222DisableThreadLibraryCalls
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll1358lstrlenW
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll870MultiByteToWideChar
KERNEL32.dll1201SizeofResource
KERNEL32.dll833LoadResource
KERNEL32.dll334FindResourceW
KERNEL32.dll99CompareStringOrdinal
KERNEL32.dll598GetProductInfo
KERNEL32.dll675GetVersionExW
KERNEL32.dll214DeleteFileW
ntdll.dll1388WinSqmIncrementDWORD
ntdll.dll1391WinSqmSetDWORD
ntdll.dll1372WinSqmAddToStream
ntdll.dll401NtQueryInformationToken
ntdll.dll212NtClose
ntdll.dll1028RtlMapGenericMask
ntdll.dll68EtwLogTraceEvent
ntdll.dll924RtlInitUnicodeString
ntdll.dll363NtOpenThreadToken
ntdll.dll355NtOpenProcessToken
ole32.dll105CoTaskMemRealloc
ole32.dll63CoInitializeEx
ole32.dll83CoRegisterClassObject
ole32.dll95CoRevokeClassObject
ole32.dll99CoSetProxyBlanket
ole32.dll14CoCreateFreeThreadedMarshaler
ole32.dll103CoTaskMemAlloc
ole32.dll104CoTaskMemFree
ole32.dll10CoAllowSetForegroundWindow
ole32.dll73CoMarshalInterThreadInterfaceInStream
ole32.dll377StringFromGUID2
ole32.dll53CoGetObject
ole32.dll16CoCreateInstance
ole32.dll49CoGetInterfaceAndReleaseStream
ole32.dll15CoCreateGuid
ole32.dll336PropVariantClear
ole32.dll108CoUninitialize
OLEAUT32.dll7
OLEAUT32.dll2
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll277
OLEAUT32.dll6
SHLWAPI.dll24
SHLWAPI.dll295StrDupW
SHLWAPI.dll252SHSetValueW
SHLWAPI.dll232SHRegGetValueW
SHLWAPI.dll628
SHLWAPI.dll278
SHLWAPI.dll618
SHLWAPI.dll260
SHLWAPI.dll493
SHLWAPI.dll538
SHLWAPI.dll494
SHLWAPI.dll514
SHLWAPI.dll204
SHLWAPI.dll174
SHLWAPI.dll156
SHLWAPI.dll276StrChrW
SHLWAPI.dll313StrRChrW
SHLWAPI.dll187SHEnumValueW
SHLWAPI.dll183SHDeleteValueW
SHLWAPI.dll179SHDeleteKeyW
SHLWAPI.dll137PathRemoveExtensionW
SHLWAPI.dll172
SHLWAPI.dll158
SHLWAPI.dll176
SHLWAPI.dll255SHStrDupW
SHLWAPI.dll256
SHLWAPI.dll219
SHLWAPI.dll437
SHLWAPI.dll16
SHLWAPI.dll199
SHLWAPI.dll154
slc.dll23SLGetWindowsInformationDWORD
SHELL32.dll18
SHELL32.dll205SHGetKnownFolderPath
SHELL32.dll25
SHELL32.dll119SHBindToObject
SHELL32.dll204SHGetKnownFolderItem
SHELL32.dll196SHGetIDListFromObject
SHELL32.dll59
SHELL32.dll155
SHELL32.dll246SHParseDisplayName
SHELL32.dll289ShellExecuteExW
SHELL32.dll290ShellExecuteW
SHELL32.dll131SHChangeNotifySuspendResume
SHELL32.dll203SHGetKnownFolderIDList
SHELL32.dll891
SHELL32.dll526
SHELL32.dll127SHChangeNotify
UxTheme.dll61IsAppThemed
GDI32.dll53CreateDIBSection
GDI32.dll509GetObjectW
GDI32.dll459GetDeviceCaps
GDI32.dll64CreateFontIndirectW
GDI32.dll48CreateCompatibleDC
GDI32.dll47CreateCompatibleBitmap
GDI32.dll525GetStockObject
GDI32.dll607Rectangle
GDI32.dll19BitBlt
GDI32.dll227DeleteDC
GDI32.dll638SetBkColor
GDI32.dll678SetTextColor
GDI32.dll84CreateSolidBrush
GDI32.dll230DeleteObject
GDI32.dll631SelectObject
GDI32.dll542GetTextExtentPoint32W
USER32.dll298GetDlgItemTextW
USER32.dll656SetDlgItemTextW
USER32.dll648SetCursor
USER32.dll680SetProcessDPIAware
USER32.dll627SendDlgItemMessageW
USER32.dll773UnregisterClassA
USER32.dll166DestroyWindow
USER32.dll156DefWindowProcW
USER32.dll735ShowWindow
USER32.dll566PostMessageW
USER32.dll163DestroyIcon
USER32.dll495LoadImageW
USER32.dll379GetSysColor
USER32.dll685SetPropW
USER32.dll363GetPropW
USER32.dll412GetWindowRect
USER32.dll483KillTimer
USER32.dll699SetTimer
USER32.dll533MessageBoxW
USER32.dll491LoadCursorW
USER32.dll289GetDC
USER32.dll613ReleaseDC
USER32.dll406GetWindowLongW
USER32.dll216EnableWindow
USER32.dll49CharNextW
USER32.dll356GetParent
USER32.dll295GetDlgItem
USER32.dll708SetWindowLongW
USER32.dll506LoadStringW
USER32.dll636SendMessageW
USER32.dll658SetFocus
USER32.dll16BringWindowToTop
USER32.dll382GetSystemMetrics
USER32.dll710SetWindowPos
USER32.dll446InvalidateRect
USER32.dll14BeginPaint
USER32.dll300GetFocus
USER32.dll220EndPaint
PROPSYS.dll148PropVariantToStringAlloc
PROPSYS.dll156PropVariantToUInt32
Secur32.dll30GetUserNameExW
ordentry_vafunction_name
10xcfc9DllCanUnloadNow
20x101caDllGetClassObject
module_nameHGCPL.dll
flags0
timestamp2010-11-20 06:48:53
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x2add0
Functions(2)0x2adc8
NameOrdinals(2)0x2add8

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionHomeGroup Control Panel
FileVersion6.1.7601.1

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0312832DLL11/20/2010 11:59:23#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] invalid VS_VERSIONINFO child type "\x00\x00\x00\x00\x00\x00"
[?] can't find file_offset of VA 0x278